KeyDrift Malware Targets Cisco SD-WAN for Sensitive Keying Material Exfiltration
APT actor UAT-11473 exploited a Cisco SD-WAN vulnerability to deploy KeyDrift malware, targeting space, defense, and policy research sectors.
Cisco Talos has uncovered a sophisticated campaign by an advanced persistent threat (APT) actor, tracked as UAT-11473, that exploited a critical vulnerability in Cisco SD-WAN Catalyst Controllers. The vulnerability, identified as CVE-2026-20127, allowed the actor to bypass authentication and gain unauthorized access to affected systems. Following the initial compromise, UAT-11473 deployed a custom malware framework named "KeyDrift," designed to establish persistent access and exfiltrate sensitive keying information.
The KeyDrift framework is engineered to operate stealthily within the Cisco SD-WAN control-plane processes. Its primary objective is to intercept and collect decrypted control traffic, extract crucial data-plane keying material, and then stage or transmit this sensitive information using encrypted records. The observed targeting spans critical sectors including space and satellite services, defense and aerospace technology, and policy research organizations. Talos assesses with high confidence that UAT-11473's operational infrastructure shows significant overlap with the "Silent Train" covert access network attributed to Volt Typhoon.
KeyDrift's architecture comprises multiple components, with PolyFlame serving as the core operational module. This memory-resident module is typically deployed through modified runit service paths and injected into legitimate running vdaemon processes. To evade detection, PolyFlame can also masquerade as a packed "aaamgrd" loader variant. Once active, it interposes itself within socket, DTLS, and runtime-linker behaviors by hooking critical functions, thereby gaining access to SD-WAN control-plane traffic from within legitimate controller daemon execution rather than relying on conventional endpoint beaconing.
Another vital component of the KeyDrift framework is LittleFilch, which handles the collection and exfiltration capabilities. This module hooks the "SSL_read" function within the vdaemon process. It then inspects decrypted control-plane buffers to extract keying material for a predefined list of edge nodes. The extracted data is staged locally in an encrypted format before being exfiltrated. The framework's design prioritizes in-band control and tasking over Cisco SD-WAN control-plane traffic, eschewing traditional fixed external beacons, hardcoded IP addresses, or specific callback domains.
Analysis of KeyDrift's deployment reveals the use of Cisco SD-WAN runit service paths as its primary execution anchor. In one observed deployment targeting the sshd service, the actor modified the service run script, remounted the /rootfs.rw filesystem as executable, and launched a malicious script named "conf_sshd" in the background. This script then enumerates running vdaemon processes and injects PolyFlame (disguised as "libdssl.so") into each of them. Variations in deployment mechanisms, such as the use of a parallel service-wrapper pattern for the aaamgr runit launcher on vBond appliances, suggest ongoing development and adaptation of the framework's capabilities.
PolyFlame's functionality extends to command execution through a TinyShell-styled backdoor and acting as an intermediate command-and-control (C2) host. It is injected into the vdaemon process, granting it access to sensitive in-process state like DTLS session keys, vEdge topology, OMP routes, and policy tables. Notably, no hardcoded C2 infrastructure details were recovered, indicating a design focused on stealth and adaptability. The implant hooks the recvfrom() API call, allowing it to intercept C2 communications and potentially forward commands to other compromised peers.
Further analysis of PolyFlame reveals a time-checking mechanism designed to ensure continued execution. The implant receives an MD5 hash of a specific date from the C2. It then calculates the MD5 hash of the local device's current date and compares it. If the hashes do not match, the implant ceases further execution. This check, along with an "administrative code" received from the C2, dictates the implant's subsequent operations, highlighting a layered approach to control and evasion. The observed variations in KeyDrift modules and deployment methods indicate that UAT-11473 is actively developing and refining this sophisticated framework.